86%(7)6 out of 7 people found this document helpful
This preview shows page 1 - 2 out of 5 pages.
CS255: Introduction to CryptographyWinter 2011Assignment #3: SolutionsAnswer 1.(a)We havedeve≡e-1eve(modφ(N)), so thatφ(N)dividesdeve·eeve-1.(b)Pick a random nonzeroginZN. In the unlikely event thatg≡0(modp), then gcd(p,N) =p,and we have factoredN, so assume that this didn’t happen. Letτp(g),τq(g)(which we don’t yet know)be the largest powers of 2 that divide ordp(g)and ordq(g), respectively. Without loss of generality, letτp(g)≤τq(g).Note that ifgis not a quadratic residue modp, which happens with probability12, thenτp(g) =τ(p-1), and otherwiseτp(g)< τ(p-1). Sinceτp(g)andτq(g)are independent, no matter whatτq(g)is, the probability thatτp(g) =τq(g)is at most12.Now computex:=gK/τ(K), then repeatedly squarex.We know thatxτq(g)≡1(modN), soconsider the previous termy:=xτq(g)/2, if there is one.Ifτp(g)< τq(g), which happens withprobability12, theny≡1(modp), buty6≡1(modq). Note that in this case we are guaranteed tohave ay, becauseτq(g)> τp(g)≥1. Then gcd(y-1,N) =p, and we have factoredN.Since the above takes roughly cubic time in logN, and works with probability12each time, we willfactorNin cubic expected time.Answer 2.First, let us definet:=d|X|/Beas the hint suggests. We start by building a tableTinthe following way: first, choose a random elementk, and addktoT. Repeatedly applyftokuntilone of the two following things happen: if we reachkagain before we have appliedftokexactlyttimes, then deletekfromT. If we have not reachedkagain after applyingftokexactlyttimes (i.e.we are in a cycle of length≤t+1) then add the element we get after applyingftokexactlyttimesto the tablet. Let us call this new elementj. We then applyftojeither until we reachkagain (inwhich case we stop) or until we have appliedfexactlyttimes, at which point we add the resultingelement into the table and continue onward in the same fashion as we have been doing. When we doreachkagain, which must happen eventually due to the fact that every element in the group must be acycle, we choose some element that we have not come across and repeat the process above as thoughthe new element werek. We can repeat this process until we have gone through all of the elements. Ofcourse, this algorithm takes quite some time, but since we have no constraints at this time, we are freeto use a sluggish algorithm (and this is why we also don’t bother to mention implementation here—anyimplementation that works is fine).Now we explain how to invert an inputy∈Xin timeO(t). Our procedure is relatively simple.First, ifyis in our table, then we are done, so we clearly do not have to worry about these cases. Sosuppose thatyis not in the table. In this case, we applyftoyrepeatedly until we reach an elementin our table or until we reachyagain, always keeping track of the previous element. Note that ifyis in a cycle that does not contain a table entry, then the cycle length must be less thant